Fix password change issue.

2020-09-15 08:50:05 -07:00
parent 1cfb9e18a1
commit bde1949e8f
2 changed files with 4 additions and 4 deletions
--- a/pages/api/account/password.js
+++ b/pages/api/account/password.js
@@ -6,10 +6,10 @@ import { checkPassword, hashPassword } from 'lib/crypto';
 export default async (req, res) => {
  await useAuth(req, res);

-  const { user_id, is_admin } = req.auth;
-  const { current_password, new_password } = req.body;
+  const { user_id: auth_user_id, is_admin } = req.auth;
+  const { user_id, current_password, new_password } = req.body;

-  if (is_admin) {
+  if (!is_admin || user_id !== auth_user_id) {
    return unauthorized(res);
  }